Hancitor Nov 29

https://www.hybrid-analysis.com/sample/d8a877d45fb6521287734768370ec3e814b11941235b109487a677436d472d27?environmentId=100

comments by @techhelplist in the below link:
https://www.virustotal.com/en/file/d8a877d45fb6521287734768370ec3e814b11941235b109487a677436d472d27/analysis/#comments

hancitor links
http://cutproofhockeysocks.com?2u3v18EoAG=
http://medivenplus.com?ome3Hu5=
http://jobstactivewear.com?0iOx8877CkT=

additional payload dl
http://powerindo.com/wp-content/plugins/image-widget/1
http://powerindo.com/wp-content/plugins/image-widget/2
http://powerindo.com/wp-content/plugins/image-widget/3

hancitor c2
http://tanhindinttoft.com/ls5/forum.php

pony c2
http://tanhindinttoft.com/mlu/forum.php

pandabanker dl
https://rowrorofrat.com/3rafesimuuvutubazromu.dat
https://rowrorofrat.com/webinjects.dat
https://rowrorofrat.com/3rafesimuuvutubazromu.exe
https://rowrorofrat.com/webinject32.bin
https://rowrorofrat.com/grabber.bin
https://rowrorofrat.com/vnc32.bin
https://rowrorofrat.com/backsocks.bin
https://rowrorofrat.com/keylogger.bin